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Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTICE 


Digivo Media Limited 


Office One, 1 Coldbath Square, London, EC1R 5HL 


The Information Commissioner (“the Commissioner”) has decided to 
issue Digivo Media Limited (“Digivo”) with an enforcement notice under 
section 40 of the Data Protection Act 1998 (“DPA”). The notice is being 
issued because of a serious contravention of Regulation 22 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Digivo, whose registered office is given above (Companies House 
Registration Number: 12806848) is the organisation stated in this 
notice to have transmitted and instigated the transmission of 
unsolicited communications by means of electronic mail to individual 
subscribers for the purposes of direct marketing contrary to regulation 
22 of PECR. 
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4. Regulation 22 of PECR states: 


"(1) This regulation applies to the transmission of unsolicited 
communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of advertising 
or marketing material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


From 1 January 2021, consent in PECR has been defined by reference 
to the concept of consent in the UK GDPR as defined in section 3(10) of 
the DPA 2018/4]: see regulation 2(1) of PECR, as amended by Part 3 of 
Schedule 3, paragraph 44 of The Data Protection, Privacy and 
Electronic Communications (Amendments etc) (EU Exit) Regulations 
2019/419. Article 4(11) of the UK GDPR sets out the following 
definition: “'consent’ of the data subject means any freely given, 
specific, informed and unambiguous indication of the data subject's 
wishes by which he or she, by a statement or by a clear affirmative 
action, signifies agreement to the processing of personal data relating 


to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 


communications network which can be stored in the network or in the 


i The UK GDPR is therein defined as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 
April 2016 (“GDPR”) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue 
of section 3 of the European Union (Withdrawal) Act 2018. 
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recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 
to electronic mail. The soft opt-in rule can only be relied upon by the 


organisation that collected the contact details. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, he may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are so specified. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 
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The contravention 
The Commissioner finds that Digivo contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


Between 24 March 2021 and 7 September 2021 Digivo transmitted and 
instigated the transmission of 479,017 direct marketing messages 
sent, contrary to regulation 22 of PECR, of which 415,041 were 


received by subscribers. 


The Commissioner finds that Digivo, as the sender and instigator of the 
direct marketing, is required to ensure that it is acting in compliance 
with the requirements of regulation 22 of PECR, and to ensure that 


valid consent to send those messages had been acquired. 


For consent to be valid it is required to be “freely given”, by which it 
follows that if consent to marketing is a condition of subscribing to a 
service, the organisation will have to demonstrate how the consent can 
be said to have been given freely. Digivo relied on a statement which 
must be ticked to proceed with the application, meaning that the 


consent obtained is not freely given. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 
organisation, that will be sending it. In this instance, the statement 
asks individuals to consent to receiving email, telephone, and SMS, 
with no option to pick between the communication channels. This 


means the consent obtained by Digivo is not specific. 


Consent will not be “informed” if individuals do not understand what 


they are consenting to. Organisations should therefore always ensure 
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that the language used is clear, easy to understand, and not hidden 

away in a privacy policy or small print. Consent will not be valid if 

individuals are asked to agree to receive marketing from “similar 


"mO "mO 


organisations”, “partners”, “selected third parties” or other similar 
generic description. In this instance, the statement does not reference 
marketing at all and only states that individuals will be contacted by 
third party debt solution providers, not that the individual will receive 


further contact from Digivo, so the consent obtained is not informed. 


The Commissioner is therefore satisfied from the evidence he has seen 
that Digivo did not have the necessary valid consent for the 415,041 


direct marketing messages received by individual subscribers. 


The Commissioner has considered, as he is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage. The 
Commissioner has decided that it is unlikely that damage has been 


caused in this instance. 


In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of his powers under 
section 40 of the DPA, he requires Digivo to take the steps 


specified in Annex 1 of this Notice. 


Right of Appeal 


There is a right of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 3 day of October 2023 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


TERMS OF THE ENFORCEMENT NOTICE 


Digivo shall within 30 days of the date of this notice: 


Except in the circumstances referred to in paragraph (3) of 
regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 
direct marketing by means of electronic mail unless the recipient of 
the electronic mail has previously notified Digivo that he clearly and 
specifically consents for the time being to such communications 


being sent by, or at the instigation of, Digivo. 
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ANNEX 2 


RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2: If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that he ought to have exercised his discretion 


differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 


Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


Information Commissioner's Office 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 


